A tor encrypted traffic classification method based on BiLSTM

Abstract

The application provides a Tor encrypted traffic classification method based on BiLSTM, and specifically comprises the following steps: S1, pre-processing a data set; S2, improving a GSK algorithm in parallel strategy to obtain a PGSK algorithm; S3, improving the PGSK algorithm in compact strategy to obtain a PCGSK algorithm; S4, performing parameter optimization on the maximum iteration number, initial learning rate and hidden layer of the BiLSTM by using the PCGSK algorithm; S5, introducing an attention mechanism to the optimized BiLSTM to strengthen the proportion of important features; and S6, classifying a Tor data set by using a PCGSK-BiLSTM. The technical scheme of the application overcomes the problem of low classification accuracy of the Tor encrypted traffic classification method in the prior art.

Description

Technical Field

[0001] This invention relates to the fields of data processing and encrypted traffic classification technology, specifically to a Tor encrypted traffic classification method based on BiLSTM. Background Technology

[0002] Encrypted traffic identification is fundamental to the management, traffic analysis, and anomaly detection in today's vast and complex networks. With the widespread adoption and rapid development of the internet, cybersecurity has risen to the national level. A 2020 report by Google stated that as of May 2019, 94% of Google's network traffic was encrypted, and by 2023, 97% of Google websites would have HTTP encryption by default, and 100% of websites would support HTTP encryption. The massive amount of data transmitted via encryption on the internet presents challenges to the monitoring of network behavior. Many malicious actors exploit encrypted traffic to conceal their true attack objectives. Therefore, effectively detecting, identifying, and processing encrypted traffic has become a crucial line of defense for maintaining network security.

[0003] The Tor system embodies the Onion routing technology. Tor has two entities: Tor users and Tor nodes. Tor nodes provide relay services and are the core of the Tor network. Tor users run a local Onion Proxy (OP) program within the system. This program selects a relay node, establishes a channel through the relay node, receives application TCP data streams, and transmits these data streams through the established channel. User communication transmitted through the Tor network includes both legitimate user behavior and abusive behavior. Because the Tor network mechanism is that the exit node represents the user in accessing the final destination service, when abusive behavior occurs, the destination service sees malicious behavior initiated by the exit node. The direct result is often that the destination service blocks access to the exit node, thereby blocking all communication accessing the same destination service through that exit node. Some traffic transmitted in the Tor network uses insecure application protocols, such as Telnet and POP3. Therefore, some malicious Tor nodes, when acting as exit nodes of transmission channels, run corresponding logging programs to record sensitive data transmitted. For example, usernames and passwords transmitted via Telnet or POP3 protocols are recorded and sold to relevant companies and organizations for commercial purposes. Currently, some domestic technology companies have developed software to detect IP proxies, used to detect Tor connections, prevent fraud, enhance traffic filtering, and avoid issues such as fake account registration.

[0004] Traffic classification initially used port mapping to identify and categorize traffic, establishing a lookup table between ports and application traffic for lookup purposes, thus achieving encrypted traffic classification. However, with the advent of port hopping and multiplexing technology, port mapping became unsuitable. Deep packet inspection (DPI) requires parsing the packet header and payload content of traffic data and maintaining a matching library of traffic categories and special fields. However, with the transmission of encrypted traffic, the performance of DPI-based traffic classification is significantly reduced. Due to the drawbacks of the above two classification methods, researchers turned their attention to the field of machine learning, constructing statistical features for data packets including flow duration, number of bytes transmitted, number of packets, and packet interval duration, achieving good results. However, machine learning-based traffic identification relies heavily on expert knowledge and experience in the feature selection process, making the classification accuracy largely dependent on the quality of feature selection. Compared to the shortcomings of machine learning in feature selection, deep learning directly models features from the input data by automatically extracting features.

[0005] Therefore, there is a need for a deep learning-based Tor encrypted traffic classification method that can automatically extract features and has higher classification accuracy. Summary of the Invention

[0006] The main objective of this invention is to provide a BiLSTM-based Tor encrypted traffic classification method to solve the problem of low classification accuracy in existing Tor encrypted traffic classification methods.

[0007] To achieve the above objectives, this invention provides a Tor encrypted traffic classification method based on BiLSTM, specifically including the following steps: S1, preprocessing the dataset; S2, improving the GSK algorithm with a parallel strategy to obtain the PGSK algorithm; S3, improving the PGSK algorithm with a compact strategy to obtain the PCGSK algorithm; S4, using the PCGSK algorithm to optimize the parameters of the BiLSTM, including the maximum number of iterations, initial learning rate, and hidden layer; S5, introducing an attention mechanism into the optimized BiLSTM to increase the weight of important features; S6, using PCGSK-BiLSTM to classify the Tor dataset.

[0008] Further, step S1 specifically includes: extracting traffic statistics features from the original dataset, including flow duration, number of bytes per second, and average packet size.

[0009] Furthermore, step S2 specifically includes the following steps:

[0010] S2.1, Divide the population into G groups, with the population size in each group being N / G;

[0011] S2.2, use the GSK algorithm to evaluate the best individual in each group and find the best solution for each group;

[0012] S2.3, compare the optimal solutions of each group in group G, select the optimal solution of the entire group from the optimal solutions of group G as the global optimal solution and record it;

[0013] S2.4 Sort the groups according to their fitness function values, and replace the group with the worst fitness function value with the group with the best fitness function value.

[0014] Furthermore, step S3 specifically includes the following steps:

[0015] S3.1, first use the inverse functions of PV and CDF to generate a solution x1;

[0016] S3.2, use the position update formula to update x1 to obtain x2;

[0017] S3.3, compare x2 and x1, and designate the one with better adaptability as the winner and the one with poorer adaptability as the loser;

[0018] S3.4, update PV and global optimal solution using winner and loser, and proceed to the next loop.

[0019] The PV update formula is:

[0020]

[0021]

[0022] Where i represents the i-th dimension, N p denoted as the virtual population size, t represents the number of iterations, μ and σ are the parameters of the truncated normal distribution, winner[i] represents the solution with better fitness, and loser[i] represents the solution with poorer fitness.

[0023] Further, step S5 specifically involves using two fully connected layers. The first fully connected layer uses the ReLU activation function, and the second fully connected layer uses the Sigmoid activation function, so that the weights are mapped to the range (0, 1).

[0024] The present invention has the following beneficial effects:

[0025] The method provided in this invention solves the problem of low accuracy in Tor encrypted traffic classification methods. To address the shortcomings in classification performance of Tor encrypted traffic classification methods, the PCGSK algorithm is used to optimize the parameters of BiLSTM, including the maximum number of iterations, initial learning rate, and hidden layers, thereby improving classification accuracy. Attached Figure Description

[0026] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0027] Figure 1 A flowchart of a Tor encrypted traffic classification method based on BiLSTM according to the present invention is shown.

[0028] Figure 2 A flowchart of step S5 of the present invention is shown. Detailed Implementation

[0029] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] like Figure 1 The Tor encrypted traffic classification method based on BiLSTM shown includes the following steps:

[0031] S1, preprocessing the dataset.

[0032] Specifically, step S1 includes: extracting traffic statistics features from the original dataset, including flow duration, bytes per second, and average packet size. First, 83 forward and reverse traffic statistics features are extracted from the pcap file of the original dataset, including flow duration, bytes per second, and average packet size. The flow timeout is set to 10 seconds, with TCP flows determined by FIN packets and UDP flows by timeout. Packets are first read from the pcap file, then each packet is added to the corresponding current TCP or UDP flow, continuously updating the flow statistics features during this process, and finally summarizing them into a CSV file for output. Ultimately, 26 features were selected as input to the model for classification.

[0033] S2, improves the GSK algorithm with a parallel strategy to obtain the PGSK algorithm.

[0034] Specifically, the GSK algorithm is based on the concept of acquiring and sharing knowledge throughout the human life cycle. The GSK algorithm is divided into two stages to simulate the human process of acquiring knowledge: the initial stage of acquiring and sharing knowledge and the advanced stage of acquiring and sharing knowledge.

[0035] Initial population x i Let i = 1, 2, 3, 4, ..., N, and let the population contain N people, each with x... i By x ij =(x i1 ,x i2 ,x i3 ,……,x iD The definition is as follows: D is the number of subject areas, i.e., the knowledge dimension.

[0036] f i i = 1, 2, 3, ..., N are the fitness values ​​of the individuals.

[0037] In the initial stage, the dimension acquired using the initial knowledge acquisition and sharing stage is greater than the dimension updated using the advanced knowledge acquisition and sharing stage scheme. In the advanced stage, the advanced knowledge acquisition and sharing stage scheme is greater than the initial knowledge acquisition and sharing stage scheme.

[0038] The update formula for dimension D (junior phase) of the initial knowledge acquisition and sharing stage:

[0039]

[0040] Where K is the knowledge rate, a real number greater than zero, G is the number of iterations, GEN is the maximum number of iterations, and problemsize represents the problem dimension.

[0041] The update formula for dimension D (senior phase) of the advanced knowledge acquisition and sharing stage is:

[0042] D(seniorphase)=problemsize-D(juniorphase)

[0043] The initial stage of acquiring and sharing knowledge includes the following steps:

[0044] Sort all objective function values ​​in ascending order;

[0045] For each individual x i Two distinct individuals are selected: the closest best and the closest worst, to form the knowledge gain source. In addition, another individual is randomly selected as the source of shared knowledge.

[0046] X i The update formula for i = 1, 2, ..., N is as follows:

[0047]

[0048] in For the updated individual, X r For randomly selected individuals, Kf These are parameters for knowledge factors.

[0049] The advanced knowledge acquisition and sharing phase specifically includes:

[0050] Individuals in the population are sorted in ascending order of fitness value. Then, the sorted individuals are divided into three categories: best individuals, average individuals, and worst individuals. The proportion of best individuals is p, the proportion of worst individuals is p, and the proportion of average individuals is 1-2p. Usually, p = 0.1 is taken.

[0051]

[0052] in For the updated individual, X pbest X is an individual randomly selected from the best individuals. pworst X is an individual randomly selected from the worst individuals. m K is an individual randomly selected from the average individuals. f Let f(X) be the knowledge factor parameter, and f(X) be the objective function value.

[0053] Specifically, step S2 includes the following steps:

[0054] S2.1 The parallel algorithm utilizes GSK's excellent ability to find the best location to divide the population into G groups, with each group containing N / G populations.

[0055] S2.2, use the GSK algorithm to evaluate the best individual in each group and find the best solution for each group.

[0056] S2.3 Compare the optimal solutions of each group in group G, select the optimal solution of the entire group from the optimal solutions of group G as the global optimal solution and record it.

[0057] S2.4 Sort the groups according to their fitness function values, and replace the group with the worst fitness function value with the group with the best fitness function value.

[0058] S3, the PGSK algorithm is improved with a compact strategy to obtain the PCGSK algorithm.

[0059] Specifically, in step S3, the GSK algorithm is improved by making it more compact. Compactness is to compress the space and avoid unnecessary space waste. Compressing and compacting the space used in the population iteration process will have a certain impact on the optimization ability and convergence speed. Assuming there are K individuals and the dimension is N, the position of each individual is usually updated using a position update formula. The compact algorithm uses a probability model to represent the position of each individual. Each dimension can be represented by a normal distribution, so the compact algorithm uses a Perturbation Vector (PV) to represent the probability distribution of all dimensions. In this way, a k*n matrix is ​​represented by a 2*n matrix.

[0060] Step S3 specifically includes the following steps:

[0061] S3.1 First, use the inverse functions of PV and CDF (distribution function) to generate a solution x1.

[0062] S3.2, use the position update formula to update x1 to obtain x2.

[0063] S3.3, compare x2 and x1, and designate the one with better fitness as the winner and the one with poorer fitness as the loser.

[0064] S3.4, update PV and global optimal solution using winner and loser, and proceed to the next loop.

[0065] The PV update formula is:

[0066]

[0067]

[0068] Where i represents the i-th dimension, N p PV represents the virtual population size, since there is no real population at this time. t represents the number of iterations, μ and σ are the parameters of the truncated normal distribution, winner[i] represents the solution with better fitness, and loser[i] represents the solution with poorer fitness. The fitness values ​​of the two particles are generated by comparing PV. The one with better fitness value is the winner, and the one with poorer fitness value is the loser.

[0069] S4 uses the PCGSK algorithm to optimize the parameters of BiLSTM (Bidirectional Long Short-Term Memory) network, including the maximum number of iterations, initial learning rate, and hidden layers.

[0070] Specifically, in step S4, the global optimal value obtained by the PCGSK algorithm is used to optimize the initial learning rate, maximum number of iterations, and hidden layer parameters of the BiLSTM recurrent neural network. Due to the gradient explosion problem inherent in BiLSTM and the desire to further improve the classification performance of BiLSTM, the initial learning rate, maximum number of iterations, and number of hidden layer units are important parameters that determine the classification performance of BiLSTM. Optimizing these important parameters further improves the classification performance.

[0071] The initial learning rate, maximum number of iterations, and number of hidden layer units are important parameters that determine the classification performance of BiLSTM. In GSK, the range of these three parameters is initialized. The evaluation function of the GSK algorithm is the loss rate of the LSTM. As the GSK algorithm iterates, it retains the parameter with the minimum loss rate. After a large number of iterations, the optimal solution for the three parameters is found.

[0072] S5 introduces an attention mechanism into the optimized BiLSTM to increase the weight of important features. The attention mechanism allows the vector encoded at one time step to produce different decoded vectors at different time steps, which essentially assigns a large weight value to the feature that performed best at the previous time step, amplifying the information that contributes the most.

[0073] Specifically, step S5 involves using two fully connected layers. The first fully connected layer uses the ReLU activation function, and the second fully connected layer uses the Sigmoid activation function, so that the weights are mapped to the range (0, 1).

[0074] like Figure 2 As shown, in step S5, the SE attention mechanism is introduced. The SE attention mechanism is a method for determining weights in channel attention mode. It achieves the goal of prioritizing channels by allocating weights among different channels. Two fully connected layers are used, and the non-linearity between the fully connected layers increases the model's complexity to determine the weights between different channels. The first fully connected layer uses the ReLU activation function, and the second fully connected layer uses the Sigmoid activation function to map the weights to the range (0, 1). It is worth noting that to reduce computational cost, dimensionality reduction is performed, and the output of the first fully connected layer is reduced to 1 / 4 of the input. In step S6, the PCGSK-BiLSTM is used to classify the Tor dataset. The ISCXTor2016 dataset is used to validate the model.

[0075] As shown in Table 1, Accuracy represents the proportion of all correct predictions (positive and negative). Precision reflects the intrusion detection model's ability to distinguish negative samples; the closer the Precision value is to 1, the stronger the model's ability to distinguish negative samples. Recall reflects the model's ability to distinguish positive samples; the closer the Recall value is to 1, the better the model's ability to distinguish positive samples. The F-score is a comprehensive evaluation of both Precision and Recall; the closer the F-score is to 1, the more robust the model.

[0076] Table 1. Classification Experiment Results of Different Classification Models on the Data

[0077]

[0078] The results of the above comparative experiments show that the accuracy of PCGSK-BiLSTM can reach over 94%. The accuracy of the experiment with the parallel and compact GSK algorithm to optimize the recurrent neural network parameters is higher than that without parameter optimization. The experiments show that the attention mechanism is crucial for encrypted traffic classification models.

[0079] Of course, the above description is not intended to limit the present invention, and the present invention is not limited to the examples given above. Any changes, modifications, additions or substitutions made by those skilled in the art within the scope of the present invention should also fall within the protection scope of the present invention.

Claims

1. A Tor encrypted traffic classification method based on BiLSTM, characterized in that, Specifically, the steps include the following: S1, Preprocess the dataset; S2, improve the GSK algorithm with a parallel strategy to obtain the PGSK algorithm; S3, the PGSK algorithm is improved with a compact strategy to obtain the PCGSK algorithm; S4. The PCGSK algorithm is used to optimize the parameters of BiLSTM, including the maximum number of iterations, the initial learning rate, and the hidden layer. S5 introduces an attention mechanism into the optimized BiLSTM to increase the weight of important features; S6, use PCGSK-BiLSTM to classify the Tor dataset; Step S2 specifically includes the following steps: S2.1, divide the population into G groups, with the population size in each group being N / G; S2.2, use the GSK algorithm to evaluate the best individual in each group and find the best solution for each group; S2.3, compare the optimal solutions of each group in group G, select the optimal solution of the entire group from the optimal solutions of group G as the global optimal solution and record it; S2.4 Sort the groups according to their fitness function values, and replace the group with the worst fitness function value with the group with the best fitness function value. Step S3 specifically includes the following steps: S3.1, first use the inverse functions of PV and CDF to generate a solution x1; S3.2, use the position update formula to update x1 to obtain x2; S3.3, compare x2 and x1, and designate the one with better adaptability as the winner and the one with poorer adaptability as the loser; S3.4, update PV and global optimal solution using winner and loser, and proceed to the next loop; The PV update formula is: in, Indicates the first dimension, This represents a virtual population size. Indicates the number of iterations. and It is the truncated normal distribution parameter. This indicates a solution with good fitness. This indicates a solution with poor fitness.

2. The Tor encrypted traffic classification method based on BiLSTM according to claim 1, characterized in that, Step S1 specifically includes: extracting traffic statistics features from the original dataset, including flow duration, number of bytes per second, and average packet size.

3. The Tor encrypted traffic classification method based on BiLSTM according to claim 1, characterized in that, Step S5 specifically involves using two fully connected layers. The first fully connected layer uses the ReLU activation function, and the second fully connected layer uses the Sigmoid activation function, so that the weights are mapped to the range (0, 1).

Images